Steve Gibson on HTML pings:
"Imperva research has uncovered a DDoS attack […] to perform distributed denial of services attacks […]. In one attack, which peaked at 7500 requests per second, a total of 70 million requests were generated from approximately 4,000 IP address over the course of 4 hours."
See: https://grc.com/sn/SN-710-Notes.pdf
So, HTML pings (which are there for many years) are not only bad for privacy but also for security.